CVE-2023-41180 Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++
An intermediary can bypass TLS certificate validation in Apache NiFi MiNiFi C++ due to incorrect default settings, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41180?
CVE-2023-41180 is a medium-severity vulnerability in Apache NiFi MiNiFi C++, published on 3 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS.
Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.
Weakness: CWE-295
Which versions are affected by CVE-2023-41180?
It affects 1 product.
Products include Apache Nifi Minifi C\+\+.
How do I fix CVE-2023-41180?
No fix has been published for CVE-2023-41180 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41180 being exploited?
There is no known exploitation of CVE-2023-41180 in the wild and no public exploit code.
Other vulnerabilities in Apache NiFi MiNiFi C++
Sources
Also known as GHSA-987j-v8c2-2p35.